Prompt Inspector is an open-source prompt injection detection platform that protects LLM applications and AI agents from prompt injection attacks, jailbreak attempts, and sensitive content leaks using a 5-layer detection funnel architecture.
It acts as a guardrail layer between untrusted user input and the language model, catching threats before they reach the LLM with sub-50ms response times. It is listed in the AI security category.
Instead of relying on a single model or a simple keyword list, Prompt Inspector passes each input through five progressive filtering stages — from a near-instant hash cache for known threats to semantic vector analysis and AI-powered review for novel attacks.
This keeps latency low (most requests resolve in under 50ms) while still catching edge cases.
What is Prompt Inspector?
Prompt Inspector sits between your application and your LLM, inspecting every user input before it reaches the model. The 5-layer detection funnel acts as progressively finer filters — fast, cheap layers catch obvious threats early, while slower, more sophisticated layers handle ambiguous inputs that slip through.
The design choice I like in Prompt Inspector is the five-layer funnel: cheap checks catch obvious threats, and heavier review handles ambiguous input.
| Capability | Details |
|---|---|
| 5-Layer Detection Funnel | Progressive filtering from SHA-256 hash cache through keyword matching, semantic vector analysis, AI review, and score arbitration. Each layer catches threats the previous ones missed, keeping both latency and cost low. |
| Self-Improving Payload Library | Million-scale attack database that auto-enriches from every blocked threat in production. The system learns from real-world attacks to keep strengthening its detection over time. |
| Multi-Platform Integration | REST API, Python SDK, Node.js SDK, and MCP server for Claude Desktop, Cursor, and VS Code Copilot. Fits into any development workflow or production architecture. |
Key Features
| Feature | Details |
|---|---|
| Detection Approach | 5-layer funnel: hash cache, keyword matching, semantic analysis, AI review, arbitration |
| Response Time | 10-42ms for most requests; near-zero for cached threats |
| Cost Efficiency | 60-95% lower cost, 2-7x faster than LLM-only detection |
| Payload Library | Million-scale, auto-enriched from production traffic |
| Threat Types | Prompt injection, jailbreaks, sensitive content, system prompt leaks |
| Tenant Isolation | Per-app API keys, configuration, rate limits, and logs |
| Custom Word Lists | Per-tenant sensitive word and regex pattern filtering |
| Integration | REST API, Python SDK, Node.js SDK, MCP server, Anthropic Agent Skills |
| Self-Hosting | Python 3.11+, FastAPI, PostgreSQL + pgvector, Redis |
| License | AGPL-3.0 (open-source); commercial enterprise edition available |
Detection Architecture
The 5-layer funnel processes each input through progressively deeper analysis:
| Layer | Method | Speed | Purpose |
|---|---|---|---|
| 1. Hash Cache | SHA-256 lookup | Near-zero latency | Instantly blocks previously seen malicious inputs |
| 2. Keyword Matching | Aho-Corasick pattern matching | Microseconds | Catches known attack patterns and sensitive words |
| 3. Semantic Analysis | Vector embeddings via pgvector | Milliseconds | Detects meaning-level similarities to known attacks |
| 4. AI Review | LLM-based assessment | Slower, higher cost | Evaluates ambiguous edge cases that other layers cannot classify |
| 5. Arbitration | Score aggregation | Fast | Combines signals from all layers into a final confidence score and decision |
Most malicious inputs are caught by layers 1-3, which are fast and cheap. The AI review layer (layer 4) only fires for inputs where the earlier layers produce ambiguous signals, keeping overall cost low.
Tenant Isolation
Prompt Inspector supports multi-tenant deployments where each application gets its own isolated environment. Each tenant has dedicated API keys, custom configuration (including sensitive word lists), independent rate limits, and separate logging. This makes it practical for organizations running multiple LLM applications with different threat profiles.
Custom Sensitive Word Lists
Beyond the built-in detection layers, each tenant can define custom sensitive word and regex pattern lists. These are matched in layer 2 (keyword matching) using high-performance Aho-Corasick automaton algorithms, adding organization-specific filtering without impacting detection speed.
Getting Started
- Choose your integration method — Pick from REST API (any language), Python SDK (
pip install prompt-inspector), Node.js SDK (npm install prompt-inspector), or MCP server for IDE integration with Cursor, VS Code, or Claude Desktop. - Sign up or self-host — Use the cloud service at promptinspector.io (free tier: 1,000 detections/month, no credit card) or self-host the open-source version with Python 3.11+, FastAPI, PostgreSQL with pgvector, and Redis.
- Get your API key — Each application gets its own tenant with a dedicated API key. Configure tenant-specific settings including custom sensitive word lists and rate limits.
- Integrate into your pipeline — Add Prompt Inspector between your application and LLM endpoint. All user inputs pass through the detection funnel before reaching the model. Integration typically requires adding a few lines of code at the LLM call point.
- Monitor and refine — Review detection logs to tune sensitivity. The self-improving payload library automatically learns from blocked threats, but custom word lists and tenant configuration let you fine-tune for your specific use case.
When to Use Prompt Inspector
Prompt Inspector works well for development teams building LLM-powered applications that need prompt injection protection without adding significant latency or cost. The multi-layer funnel is particularly effective when you need real-time detection (the hash cache and keyword layers respond in microseconds), cost efficiency (most threats get caught before reaching the expensive AI review layer), and self-hosted control (the open-source version runs on your infrastructure with no external dependencies).
How Prompt Inspector Compares
Prompt Inspector focuses on input-side detection — catching malicious prompts before they reach the model. For a commercial prompt injection API with large-scale training data, see Lakera Guard .
For output-side guardrails that also validate LLM responses, consider LLM Guard or NeMo Guardrails . For full inference-layer security with policy-based access controls, look at CalypsoAI or Prompt Security .
For pre-deployment vulnerability scanning rather than runtime detection, see Augustus , Garak , or FuzzyAI .
For a broader overview of AI security tools, see the AI security tools category page.